How are processes tiered?
By maximum tolerable downtime (MTD), the longest a process can be down before the harm is unacceptable. Mission Critical is an MTD under 4 hours; Essential is 4 hours up to and including 24 hours; Important is over 24 hours up to 72 hours; Deferrable is more than 3 days. The tier comes from the MTD alone, so an ambitious recovery time objective (RTO) can't promote a process that can in fact wait. The workbook then checks that each RTO is shorter than or equal to the MTD, flagging an RTO longer than the MTD in red and one equal to it in amber, and shows "CHECK MTD" for a typo instead of quietly treating it as Deferrable.
What does the dependency gap flag catch?
A vendor, system or upstream process that recovers slower than the process that relies on it. Enter the dependency's contracted or tested recovery time (or the time to switch to an alternative) and the workbook compares it with the process RTO. The FFIEC booklet makes the same point in section III.A.3: a process with a shorter RTO that depends on one with a longer RTO may indicate a gap. In the sample, the card processor's contracted 4-hour recovery time is flagged against Payment Processing's 1-hour RTO. Critical or High dependencies with no alternative are counted as single points of failure.
Which tabletop scenarios are included?
Seven, each with a scenario card, four timed injects, discussion questions, what good looks like and the notices it can trigger: TTX-01 cloud region outage, TTX-02 ransomware, TTX-03 critical vendor or core processor failure, TTX-04 key personnel unavailability or pandemic, TTX-05 social-media-driven deposit run, TTX-06 regional natural disaster (hurricane) and TTX-07 payment rail disruption (Fedwire, FedACH or a card network). The kit is planned around a two-hour session, and the Scenario Library tab tracks when each scenario was last run. Four of the scenarios have a matching case study; TTX-04, TTX-06 and TTX-07 do not.
Does it meet FFIEC or NYDFS testing requirements?
It is designed around them, but no template can meet them for you. The FFIEC Business Continuity Management booklet sets no fixed testing frequency: section VII.B says your own exercise and test policy should establish minimum frequency, scope and reporting. The kit's cadences (for example a tabletop and a hands-on test of each Mission Critical process every 12 months) are template recommendations you can change. If you are covered by the New York State Department of Financial Services (NYDFS) cybersecurity regulation, 23 NYCRR 500.16(d) requires testing your incident response and business continuity and disaster recovery plans, and your ability to restore from backups, at least annually. The booklet also says tabletop exercises by themselves are likely insufficient to validate recovery capabilities, so the workbook tracks hands-on tests separately.
We're a fintech. Who do we notify after an outage?
Usually your bank, not the bank's regulator. Under 12 CFR 53.4 and the Federal Reserve and FDIC parallels, a bank service provider notifies at least one bank-designated contact at each affected bank as soon as possible after determining that a computer-security incident has materially disrupted or degraded, or is reasonably likely to, covered services for 4 or more hours. The bank then decides on its own 36-hour notice to its primary federal regulator under 12 CFR 53.3. Your program agreement may require more, sooner. The guide, the scenario cards and the Crisis Communications Pack all assign each notice to the right sender.
What's in the Crisis Communications Pack?
An editable Word document with rules for holding statements (what to say before facts are confirmed, and the claims that need sign-off first), an approval chain and message log, and templates for customers, the bank partner, regulators (drafted for the right sender), employees and critical vendors, plus a map of which templates each scenario uses. Every placeholder is a yellow [BRACKETED] field to replace.
Is the workbook editable, and which version of Excel do I need?
Yes. Nothing is locked or protected: white cells are inputs and gray cells are formulas. It has pre-built rows for 60 risks, 60 processes, 150 dependencies, 200 recovery steps, 60 contacts, 100 tests and 150 action items. It uses standard functions such as INDEX, MATCH, COUNTIFS, SUMPRODUCT and EDATE, with no XLOOKUP or dynamic-array functions, so Excel 2016 or later works. Enter dates as mm/dd/yyyy.
Is it aligned with ISO 22301 or NIST SP 800-34?
It draws on both but is not built to either. The MTD, RTO and RPO definitions and the rule that the RTO should be shorter than the MTD come from NIST Special Publication 800-34 Rev. 1, and the hurricane scenario cites ISO 22301:2019 Amendment 1:2024 for climate change considerations. The kit is not an ISO 22301 management system and does not prepare you for certification.
Can I share completed outputs externally?
Yes. You can use completed outputs with auditors, customers, bank partners, regulators, and internal stakeholders. Customize the template for internal business use — just don't resell or redistribute the source template files.
How do I receive the files?
Checkout is handled through Stripe. After payment, download every file immediately from the confirmation page. RiskTemplates also emails a secure access link, and Stripe sends the payment receipt separately. No account is required.
What if it's not a fit?
Email within 30 days for a full refund, no questions asked. The guarantee is meant to remove purchase risk while you evaluate whether the template fits your use case.
